CVE-2026-33222: NATS JetStream has an authorization bypass through its Management API
Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The persistent storage feature, JetStream, has a management API which has many features, amongst which are backup and restore.
Problem Description
Users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them.
Affected Versions
Any version before v2.12.6 or v2.11.15
Workarounds
If developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.
Other sources
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, if developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33222?
CVE-2026-33222 is classified as a high severity vulnerability due to its potential impact on data integrity related to NATS JetStream's management API.
How do I fix CVE-2026-33222?
To fix CVE-2026-33222, upgrade NATS server to version 2.12.6 or above, or to version 2.11.15 if you are running a prior version.
What components are affected by CVE-2026-33222?
CVE-2026-33222 affects the NATS server implementations specifically through the JetStream persistent storage management API.
What are the implications of CVE-2026-33222?
The implications of CVE-2026-33222 may include unauthorized data access or data corruption through mismanagement of backups and restores.
Is there a workaround for CVE-2026-33222?
There are no official workarounds for CVE-2026-33222; the best course of action is to promptly apply the available patches.